Recipe 9.25 Partitioning Snort Logs Into Separate Files

9.25.1 Problem

You want to split
Snort's log output into separate files, based on the
IP addresses and protocols detected.

9.25.2 Solution

# snort -l /var/log/snort -h network -r snort.log.timestamp

9.25.3 Discussion

Snort can split its formatted output into separate files, with names
based on the remote IP address and protocols used: these files
contain the same information printed by snort -v.
Select this mode of operation by using the -l
option without -b, plus the -h
option to specify the "home
network" for identification of the remote packets:

The digits following the filenames for TCP and UDP traffic refer to
the remote and local port numbers, respectively. Information about
fragmented IP packets that could not otherwise be classified is
stored in files named IP_FRAG. Details for ARP
packets are stored in a file named ARP in the
top-level logging directory.

Don't use split formatted output for logging while
sniffing packets from the network ?it's
inefficient and discards information. For logging, we recommend
binary libpcap-format files (produced by the
-b option) for speed and flexibility. [Recipe 9.16] You can always split and format the output
later, using the technique in this recipe.